I run a public AI chatbot or AI companion app that people in Colorado can use. What does Colorado's Chatbot Safety Act (HB 26-1263) require from January 1, 2027, what goes in the annual report to the Attorney General due from July 1, 2027, and what records do I need to keep to back it up?

What should I check, step by step?

1. Decide whether your product is a conversational AI service. Read the twelve exclusions in the Act; if you rely on one (for example customer support or a feature inside another app that isn't designed for companionship), write down why and date it.

2. From January 1, 2027, show the AI disclosure at the start of each user's first interaction every day, at least every three hours in a continuous conversation or as a persistent notice, and in reply to any question about whether the user is talking to a human. For known minors, the interim draft would require a persistent notice that stays visible without scrolling.
3. Write the suicide and self-harm protocol: what triggers it, which crisis services it refers to (not law enforcement), how it escalates repeated or severe signs, and where it runs (model behavior, system instructions, classifiers, human review). Version it.
4. Log every protocol event when it happens, without identifiers: an event reference, the date, the stage (detected, blocked before delivery, referral shown, escalated to a human), the protocol and classifier versions and the model version. These are what the annual counts are built from.
5. Count conversations the same way all year and write down the method. The interim draft asks for the total number of conversations behind the referral count and how you define one.
6. Plan a review sample: the interim draft asks what share of referrals actually involved suicidal ideation or self-harm risk under an evidence-based method, with the sample size and validation method, and precision, recall and false-positive and false-negative rates where they can be responsibly estimated.
7. Keep test results for each protocol and model version, before and after deployment, including multi-turn tests and results by language where you have enough data.
8. For age estimation, log reports that a user is a minor, the outcome of each (minor, not a minor, undecided) and the time to decide, and how often an initial estimate was later reversed.
9. Keep the records behind the report. Under the interim draft, the Attorney General's office can ask for underlying documentation, records or a demonstration, and you'd have 30 days to provide it.

Which AI chatbots does Colorado's Chatbot Safety Act cover?

An operator is anyone who develops and makes publicly available a conversational AI service, or offers one to consumers; app stores and search engines aren't operators just because they link to one. A conversational AI service is an AI system accessible to the general public that primarily simulates human conversation and interaction through adaptive text, visual or audio communication.

• The Act excludes, among others, software primarily designed and marketed for developers or researchers; services primarily for commerce or transactions, including recommendations, shopping, ordering, payments, delivery, returns, customer support and customer service; narrow-topic tools that can't produce sexually explicit content or keep up a dialogue about suicide or self-harm; business productivity and internal tools; voice assistants on consumer devices with the same limits; video game and theme park characters limited to their game or venue; HIPAA covered entities and business associates; school tools not designed for emotional companionship; and a feature inside other software or a social media platform that isn't designed to simulate emotional companionship.
• The session law was approved May 29, 2026. The operator duties apply from January 1, 2027 and annual reporting from July 1, 2027. The section is numbered 6-1-1708 in the session law and cited as 6-1-1710 in the interim draft rules.

What must AI chatbot operators include in Colorado's annual report to the Attorney General?

Section (6) requires an annual report to the Attorney General's office of the number of crisis service provider referral notifications issued in the preceding calendar year, the protocols used to detect, remove and respond to suicidal ideation or self-harm, the protocols used to prevent responses about suicidal ideation or self-harm actions, and any additional metrics the Attorney General decides are needed to judge whether the safeguards work.

• The report must not include identifiers or personal information about any user, the Attorney General will publish data from the reports, and operators must use evidence-based methods for measuring suicidal ideation or self-harm. The Act doesn't require operators to disclose trade secrets or confidential information.
• The Act doesn't set a general retention period for conversations. For minors, it requires tools to control whether the service keeps information from earlier sessions to personalize later ones, and whether their personal data is used for training.

What would Colorado's draft ADMT and chatbot rules add to the law?

The Attorney General's interim draft of 4 CCR 904-6 (October 6, 2026; hearing held October 26; not adopted as of November 11, 2026) would require the report to state the operator's size tier, from Tier 1 (more than 10 million monthly active users) to Tier 5 (fewer than 500,000), and to put the referral count in context: the total number of conversations over the same period with the counting method, and the share of referrals that, using an evidence-based method, were found to involve suicidal ideation or self-harm risk, with denominator, sample size and validation method.

• For each material part of the protocols, the draft asks the operator to say how and where it is enforced (model behavior, system-level instructions, classifiers or filters, human review), when a case is elevated to a human and on what thresholds, and any cases where risk is detected but no resource is given and no human is involved. For testing and monitoring, it asks for efficacy and reliability metrics over the reporting period, separated by stage (detection, blocking before delivery, delivery, escalation or referral, downstream action) where that matters, with differences across languages, modalities or model versions, and the test date and model or service version for each metric.
• The draft also asks for user age distribution, the age-estimation and minor-protection methods, counts of outside reports that a user is a minor and of minors shown prohibited sexual content, with outcomes and average and median time to resolve. A report made for another jurisdiction can be reused if it is reasonably similar, with an appendix for anything missing. Reports would go through a form on the Attorney General's website, and the office could ask for underlying documentation, source materials, records or a demonstration to verify any element, to be produced within 30 days.